Sensitive Data Alert Scanner

Sensitive Data Alert Scanner - Hook - Claude Pro Directory

Hook Content

The main content for this hook.

notification.json

json

{
  "hookConfig": {
    "hooks": {
      "notification": {
        "script": "./.claude/hooks/sensitive-data-alert-scanner.sh",
        "matchers": [
          "*"
        ]
      }
    }
  },
  "scriptContent": "#!/bin/bash\n\n# Read the tool input from stdin\nINPUT=$(cat)\nTOOL_NAME=$(echo \"$INPUT\" | jq -r '.tool_name')\nFILE_PATH=$(echo \"$INPUT\" | jq -r '.tool_input.file_path // .tool_input.path // \"\"')\n\nif [ -z \"$FILE_PATH\" ]; then\n  exit 0\nfi\n\n# Only scan for Write and Edit operations\nif [[ \"$TOOL_NAME\" != \"Write\" && \"$TOOL_NAME\" != \"Edit\" ]]; then\n  exit 0\nfi\n\necho \"🔒 Sensitive Data Alert Scanner - Analyzing file for security risks...\"\necho \"📄 File: $FILE_PATH\"\n\n# Check if file exists and is readable\nif [ ! -f \"$FILE_PATH\" ]; then\n    echo \"⚠️ File not found: $FILE_PATH\"\n    exit 0\nfi\n\n# Skip binary files\nif file \"$FILE_PATH\" | grep -q binary; then\n    echo \"ℹ️ Skipping binary file\"\n    exit 0\nfi\n\nSECURITY_ISSUES=0\nWARNINGS=0\n\necho \"🔍 Scanning for sensitive data patterns...\"\n\n# 1. API Keys and Secrets\necho \"🔑 Checking for API keys and secrets...\"\nAPI_PATTERNS=(\n    \"api[_-]?key\\s*[:=]\\s*[\\\"'][^\\\"']{8,}[\\\"']\"\n    \"secret[_-]?key\\s*[:=]\\s*[\\\"'][^\\\"']{8,}[\\\"']\"\n    \"access[_-]?token\\s*[:=]\\s*[\\\"'][^\\\"']{10,}[\\\"']\"\n    \"private[_-]?key\\s*[:=]\\s*[\\\"'][^\\\"']{20,}[\\\"']\"\n    \"client[_-]?secret\\s*[:=]\\s*[\\\"'][^\\\"']{8,}[\\\"']\"\n)\n\nfor pattern in \"${API_PATTERNS[@]}\"; do\n    if grep -iE \"$pattern\" \"$FILE_PATH\" 2>/dev/null | grep -v -iE \"(\\*\\*\\*|example|placeholder|your[_-]|demo|test|fake|dummy)\"; then\n        echo \"🚨 SECURITY ALERT: Potential API key/secret detected!\"\n        SECURITY_ISSUES=$((SECURITY_ISSUES + 1))\n    fi\ndone\n\n# 2. Password patterns\necho \"🔐 Checking for password exposure...\"\nPASSWORD_PATTERNS=(\n    \"password\\s*[:=]\\s*[\\\"'][^\\\"']{6,}[\\\"']\"\n    \"passwd\\s*[:=]\\s*[\\\"'][^\\\"']{6,}[\\\"']\"\n    \"pwd\\s*[:=]\\s*[\\\"'][^\\\"']{6,}[\\\"']\"\n)\n\nfor pattern in \"${PASSWORD_PATTERNS[@]}\"; do\n    if grep -iE \"$pattern\" \"$FILE_PATH\" 2>/dev/null | grep -v -iE \"(\\*\\*\\*|example|placeholder|your[_-]|demo|test|123456|password)\"; then\n        echo \"🚨 SECURITY ALERT: Potential password detected!\"\n        SECURITY_ISSUES=$((SECURITY_ISSUES + 1))\n    fi\ndone\n\n# 3. Database connection strings\necho \"🗄️ Checking for database credentials...\"\nif grep -iE \"(mysql://|postgresql://|mongodb://|redis://).*:.*@\" \"$FILE_PATH\" 2>/dev/null; then\n    echo \"🚨 SECURITY ALERT: Database connection string with credentials detected!\"\n    SECURITY_ISSUES=$((SECURITY_ISSUES + 1))\nfi\n\n# 4. JWT tokens\necho \"🎫 Checking for JWT tokens...\"\nif grep -E \"eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\" \"$FILE_PATH\" 2>/dev/null; then\n    echo \"🚨 SECURITY ALERT: JWT token detected!\"\n    SECURITY_ISSUES=$((SECURITY_ISSUES + 1))\nfi\n\n# 5. SSH private keys\necho \"🔑 Checking for SSH private keys...\"\nif grep -q \"BEGIN.*PRIVATE KEY\" \"$FILE_PATH\" 2>/dev/null; then\n    echo \"🚨 SECURITY ALERT: SSH private key detected!\"\n    SECURITY_ISSUES=$((SECURITY_ISSUES + 1))\nfi\n\n# 6. Email addresses (warning, not critical)\necho \"📧 Checking for email addresses...\"\nif grep -E \"[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Z|a-z]{2,}\" \"$FILE_PATH\" 2>/dev/null | head -3; then\n    echo \"⚠️ Email addresses detected - ensure this is intentional\"\n    WARNINGS=$((WARNINGS + 1))\nfi\n\n# 7. Credit card patterns (basic check)\necho \"💳 Checking for credit card numbers...\"\nif grep -E \"[0-9]{4}[\\s-]?[0-9]{4}[\\s-]?[0-9]{4}[\\s-]?[0-9]{4}\" \"$FILE_PATH\" 2>/dev/null; then\n    echo \"🚨 SECURITY ALERT: Potential credit card number detected!\"\n    SECURITY_ISSUES=$((SECURITY_ISSUES + 1))\nfi\n\n# 8. Social Security Numbers (US format)\necho \"🆔 Checking for SSN patterns...\"\nif grep -E \"[0-9]{3}-[0-9]{2}-[0-9]{4}\" \"$FILE_PATH\" 2>/dev/null; then\n    echo \"🚨 SECURITY ALERT: Potential SSN detected!\"\n    SECURITY_ISSUES=$((SECURITY_ISSUES + 1))\nfi\n\n# 9. Phone numbers\necho \"📞 Checking for phone numbers...\"\nif grep -E \"\\+?[1-9][0-9]{1,3}[\\s-]?\\(?[0-9]{3}\\)?[\\s-]?[0-9]{3}[\\s-]?[0-9]{4}\" \"$FILE_PATH\" 2>/dev/null; then\n    echo \"⚠️ Phone numbers detected - verify if intentional\"\n    WARNINGS=$((WARNINGS + 1))\nfi\n\n# Summary\necho \"\"\necho \"📊 Security Scan Results:\"\necho \"  • Critical Issues: $SECURITY_ISSUES\"\necho \"  • Warnings: $WARNINGS\"\n\nif [ $SECURITY_ISSUES -gt 0 ]; then\n    echo \"\"\n    echo \"🚨 CRITICAL SECURITY ALERT!\"\n    echo \"🛡️ Action Required:\"\n    echo \"  • Review detected sensitive data immediately\"\n    echo \"  • Remove or mask sensitive information\"\n    echo \"  • Use environment variables for secrets\"\n    echo \"  • Consider using a secrets management service\"\n    echo \"  • Check if file should be added to .gitignore\"\nfi\n\nif [ $WARNINGS -gt 0 ]; then\n    echo \"\"\n    echo \"⚠️ Security Warnings:\"\n    echo \"  • Review detected information for necessity\"\n    echo \"  • Consider data privacy implications\"\n    echo \"  • Verify compliance with data protection regulations\"\nfi\n\necho \"\"\necho \"💡 Security Best Practices:\"\necho \"  • Use environment variables for sensitive data\"\necho \"  • Implement proper secrets management\"\necho \"  • Add sensitive files to .gitignore\"\necho \"  • Regular security audits of codebase\"\necho \"  • Use code scanning tools in CI/CD\"\n\necho \"\"\necho \"🎯 Security scan complete!\"\n\nexit 0"
}

Features

Key capabilities and functionality

Real-time sensitive data detection
API key and token scanning
Password exposure prevention
Email address detection
Personal information monitoring
Immediate security alerts

Installation

Setup instructions and requirements

Claude Code Setup

Create hooks directory: mkdir -p .claude/hooks
Create hook script: .claude/hooks/sensitive-data-alert-scanner.sh
Add hook configuration to your Claude Code config
Make script executable: chmod +x .claude/hooks/sensitive-data-alert-scanner.sh
Restart Claude Code to activate the hook

Configuration Paths

project

.claude/hooks/

user

~/.claude/hooks/

Requirements

Claude Code CLI
Bash shell
Hook-specific dependencies (e.g., jq, prettier)

Hook Configuration

Hook setup and script content

notification-config.json

json

{
  "hooks": {
    "notification": {
      "script": "./.claude/hooks/sensitive-data-alert-scanner.sh",
      "matchers": [
        "*"
      ]
    }
  }
}

notification-script.sh

bash

#!/bin/bash

# Read the tool input from stdin
INPUT=$(cat)
TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name')
FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // .tool_input.path // ""')

if [ -z "$FILE_PATH" ]; then
  exit 0
fi

# Only scan for Write and Edit operations
if [[ "$TOOL_NAME" != "Write" && "$TOOL_NAME" != "Edit" ]]; then
  exit 0
fi

echo "🔒 Sensitive Data Alert Scanner - Analyzing file for security risks..."
echo "📄 File: $FILE_PATH"

# Check if file exists and is readable
if [ ! -f "$FILE_PATH" ]; then
    echo "⚠️ File not found: $FILE_PATH"
    exit 0
fi

# Skip binary files
if file "$FILE_PATH" | grep -q binary; then
    echo "ℹ️ Skipping binary file"
    exit 0
fi

SECURITY_ISSUES=0
WARNINGS=0

echo "🔍 Scanning for sensitive data patterns..."

# 1. API Keys and Secrets
echo "🔑 Checking for API keys and secrets..."
API_PATTERNS=(
    "api[_-]?key\s*[:=]\s*[\"'][^\"']{8,}[\"']"
    "secret[_-]?key\s*[:=]\s*[\"'][^\"']{8,}[\"']"
    "access[_-]?token\s*[:=]\s*[\"'][^\"']{10,}[\"']"
    "private[_-]?key\s*[:=]\s*[\"'][^\"']{20,}[\"']"
    "client[_-]?secret\s*[:=]\s*[\"'][^\"']{8,}[\"']"
)

for pattern in "${API_PATTERNS[@]}"; do
    if grep -iE "$pattern" "$FILE_PATH" 2>/dev/null | grep -v -iE "(\*\*\*|example|placeholder|your[_-]|demo|test|fake|dummy)"; then
        echo "🚨 SECURITY ALERT: Potential API key/secret detected!"
        SECURITY_ISSUES=$((SECURITY_ISSUES + 1))
    fi
done

# 2. Password patterns
echo "🔐 Checking for password exposure..."
PASSWORD_PATTERNS=(
    "password\s*[:=]\s*[\"'][^\"']{6,}[\"']"
    "passwd\s*[:=]\s*[\"'][^\"']{6,}[\"']"
    "pwd\s*[:=]\s*[\"'][^\"']{6,}[\"']"
)

for pattern in "${PASSWORD_PATTERNS[@]}"; do
    if grep -iE "$pattern" "$FILE_PATH" 2>/dev/null | grep -v -iE "(\*\*\*|example|placeholder|your[_-]|demo|test|123456|password)"; then
        echo "🚨 SECURITY ALERT: Potential password detected!"
        SECURITY_ISSUES=$((SECURITY_ISSUES + 1))
    fi
done

# 3. Database connection strings
echo "🗄️ Checking for database credentials..."
if grep -iE "(mysql://|postgresql://|mongodb://|redis://).*:.*@" "$FILE_PATH" 2>/dev/null; then
    echo "🚨 SECURITY ALERT: Database connection string with credentials detected!"
    SECURITY_ISSUES=$((SECURITY_ISSUES + 1))
fi

# 4. JWT tokens
echo "🎫 Checking for JWT tokens..."
if grep -E "eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+" "$FILE_PATH" 2>/dev/null; then
    echo "🚨 SECURITY ALERT: JWT token detected!"
    SECURITY_ISSUES=$((SECURITY_ISSUES + 1))
fi

# 5. SSH private keys
echo "🔑 Checking for SSH private keys..."
if grep -q "BEGIN.*PRIVATE KEY" "$FILE_PATH" 2>/dev/null; then
    echo "🚨 SECURITY ALERT: SSH private key detected!"
    SECURITY_ISSUES=$((SECURITY_ISSUES + 1))
fi

# 6. Email addresses (warning, not critical)
echo "📧 Checking for email addresses..."
if grep -E "[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}" "$FILE_PATH" 2>/dev/null | head -3; then
    echo "⚠️ Email addresses detected - ensure this is intentional"
    WARNINGS=$((WARNINGS + 1))
fi

# 7. Credit card patterns (basic check)
echo "💳 Checking for credit card numbers..."
if grep -E "[0-9]{4}[\s-]?[0-9]{4}[\s-]?[0-9]{4}[\s-]?[0-9]{4}" "$FILE_PATH" 2>/dev/null; then
    echo "🚨 SECURITY ALERT: Potential credit card number detected!"
    SECURITY_ISSUES=$((SECURITY_ISSUES + 1))
fi

# 8. Social Security Numbers (US format)
echo "🆔 Checking for SSN patterns..."
if grep -E "[0-9]{3}-[0-9]{2}-[0-9]{4}" "$FILE_PATH" 2>/dev/null; then
    echo "🚨 SECURITY ALERT: Potential SSN detected!"
    SECURITY_ISSUES=$((SECURITY_ISSUES + 1))
fi

# 9. Phone numbers
echo "📞 Checking for phone numbers..."
if grep -E "\+?[1-9][0-9]{1,3}[\s-]?\(?[0-9]{3}\)?[\s-]?[0-9]{3}[\s-]?[0-9]{4}" "$FILE_PATH" 2>/dev/null; then
    echo "⚠️ Phone numbers detected - verify if intentional"
    WARNINGS=$((WARNINGS + 1))
fi

# Summary
echo ""
echo "📊 Security Scan Results:"
echo "  • Critical Issues: $SECURITY_ISSUES"
echo "  • Warnings: $WARNINGS"

if [ $SECURITY_ISSUES -gt 0 ]; then
    echo ""
    echo "🚨 CRITICAL SECURITY ALERT!"
    echo "🛡️ Action Required:"
    echo "  • Review detected sensitive data immediately"
    echo "  • Remove or mask sensitive information"
    echo "  • Use environment variables for secrets"
    echo "  • Consider using a secrets management service"
    echo "  • Check if file should be added to .gitignore"
fi

if [ $WARNINGS -gt 0 ]; then
    echo ""
    echo "⚠️ Security Warnings:"
    echo "  • Review detected information for necessity"
    echo "  • Consider data privacy implications"
    echo "  • Verify compliance with data protection regulations"
fi

echo ""
echo "💡 Security Best Practices:"
echo "  • Use environment variables for sensitive data"
echo "  • Implement proper secrets management"
echo "  • Add sensitive files to .gitignore"
echo "  • Regular security audits of codebase"
echo "  • Use code scanning tools in CI/CD"

echo ""
echo "🎯 Security scan complete!"

exit 0

Use Cases

Common scenarios and applications

Prevent accidental commits of API keys and secrets
Detect exposed passwords in code files
Monitor for personal information leaks
Alert on potential security vulnerabilities
Scan for hardcoded credentials
Identify email addresses in code
Prevent sensitive data exposure in repositories
Maintain security compliance standards

Troubleshooting

Common issues and solutions

False positives on example code and test fixtures with dummy keys
Exclusion patterns filter common placeholders but miss context-specific ones. Add .securityignore file and check: grep -qF "$FILE_PATH" .securityignore && exit 0 to whitelist specific files or patterns.
Notification hook timing runs before file write completes causing empty scans
Notification hooks fire during operation, not after. File may not exist yet. Add retry loop: for i in {1..5}; do [ -f "$FILE_PATH" ] && break; sleep 0.1; done before scanning to ensure file availability.
Notification hook receives different INPUT schema than PostToolUse
Notification hooks fire mid-operation with partial data. Input may lack file_path or use alternative fields. Extend jq filter: '.file_path // .tool_input.file_path // .path // ""' to handle schema variations across hook types.
Grep patterns match commented-out secrets in code documentation
Current regex doesn't exclude comments. Add language-aware filtering: grep -v '^\s*[#/]' for basic comment detection, or use awk to skip comment blocks before pattern matching for comprehensive filtering.
Security scan exits zero even when critical issues detected
Script always exits 0 regardless of SECURITY_ISSUES count. Change final exit: [ $SECURITY_ISSUES -gt 0 ] && exit 1 || exit 0 to fail hook on findings, forcing Claude to acknowledge security alerts before proceeding.

Reviews (0)

Sort by:

Loading reviews...

Automate with Claude Hooks

Get the latest automation hooks delivered weekly.

Join our community of Claude power users. No spam, unsubscribe anytime.

Claude Code Setup

Configuration Paths

Requirements

Reviews (0)

Category

Source

Accessibility Checker

API Endpoint Documentation Generator

Auto Code Formatter Hook